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U.S.  Department  of  Justice 


Office  of  Legislative  Affidrs 


Of!ic«  of  the  Assistant  Attocney  Oenent 


Washington,  D.C.  20530 


February  2, 2011 


The  Honorable  Dianne  Feinstein 
Chairman 

The  Honorable  Saxby  Chambliss 
Vice  Chairman 

Select  Committee  on  Intelligence 
United  States  Senate 
Washington,  DC  20510 

Dear  Madam  Chairman  and  Mr.  Vice  Chairman: 

■trS)-Please  find  enclosed  an  D5>dated  document  that  describes  the  bulk  collection  programs 
conducted  under  Section  215  of  the  PATRIOT  Act  (the  "business  records"  provision  of  the 
Foreign  Intelligence  Surveillance  Act  (FISA))  and  Section  402  of  FISA  (the  "pen/tr^" 
provision).  The  Department  and  the  Intelligence  Community  jointly  prepared  the  enclosed 
document  that  describes  these  two  bulk  collection  programs,  the  authorities  under  which  they 
operate,  the  restrictions  imposed  by  the  Foreign  Intelligence  Surveillance  Court,  the  National 
Security  Agency's  record  of  compliance,  and  the  importance  of  these  programs  to  the  national 
sectnity  of  the  United  States. 

'trS).^We  believe  that  making  this  document  available  to  all  Members  of  Congress,  as  we  did 
with  a similar  document  in  December  2009,  is  an  effective  way  to  inform  the  legislative  debate 
about  reauthorization  of  Section  215.  However,  as  you  know,  it  is  critical  that  Members 
understand  the  importance  to  national  security  of  maintaining  the  secrecy  of  these  programs,  and 
that  the  SSCI's  plan  to  make  the  document  available  to  other  Members  is  subject  to  the  strict 
rules  set  forth  below. 

1(TSXLike  the  document  provided  to  the  Committee  on  December  13, 2009,  the  enclosed 
docviment  is  being  provided  on  the  understanding  that  it  will  be  provided  only  to  Members  of 
Congress  (and  cleared  SSCI,  Judiciary  Committee,  and  leadership  staff),  in  a secure  location  in 
the  SSCI’s  offices,  for  a limited  time  period  to  be  agreed  upon,  and  consistait  with  the  rules  of 
the  SSCI  regarding  review  of  classified  information  and  non-disclosure  agreements.  No 
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photocopies  may  be  made  of  the  document,  and  any  notes  taken  by  Members  may  not  be 
removed  from  the  secure  location.  We  further  understand  that  SSCI  staff  will  be  present  at  all 
times  when  the  document  is  being  reviewed,  and  that  Executive  Branch  officials  will  be 
available  nearby  during  certain,  pre-established  times  to  answer  questions  should  they  arise.  We 
also  request  your  support  in  ensuring  that  the  Members  are  well  informed  regarding  the 
importance  of  this  classified  and  extremely  sensitive  information  to  prevent  any  unauthorized 
disclosures  resulting  from  this  process.  We  intend  to  provide  the  same  document  to  the  House 
Permanent  Select  Committee  on  Intelligence  (HPSCI)  under  similar  conditions,  so  that  it  may  be 
made  available  to  the  Members  of  the  House,  as  well  as  cleared  leadership,  HPSCI  and  House 
Judiciary  Committee  staff. 

(U)  We  look  forward  to  continuing  to  work  with  you  and  your  staff  as  Congress  continues  its 
deliberations  on  reauthorizing  the  expiring  provisions  of  the  USA  PATRIOT  Act. 


Sincerely, 


Ronald  Welch 
Assistant  Attorney  General 


Enclosure 
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Office  of  Legislative  Affairs 


U.S.  Department  of  Justice 


Office  of  tKe  Assistant  Attoniey  Geaeral 


Vashiiigton,  D.C.  2(tS30 


Febnuiry  2, 201 1 


The  Honorable  Mike  Rogers 
Chairman 

The  Honorable  C.A.  Dutch  Ruppersberger 
Ranking  Minority  Member 
Permanent  Select  Committee  on  Intelligence 
U.S.  Hoiise  of  Representatives 
Washington,  DC  20515 

Dear  Mr.  Chairman  and  Congressman  Ruppersberger: 

TTS).  Please  find  enclosed  an  updated  document  that  describes  the  bulk  collection  programs 
conducted  under  Section  215  of  the  PATRIOT  Act  (the  "business  records"  provision  of  the 
Foreign  Intelligence  Surveillance  Act  (FISA))  and  Section  402  of  FISA  (the  "pen/trap" 
provision).  The  Department  and  the  Intelligence  Community  jointly  prepared  the  enclosed 
document  that  describes  these  two  bulk  collection  programs,  the  authorities  under  which  they 
operate,  the  restrictions  imposed  by  the  Foreign  Intelligence  Surveillance  Court,  the  National 
Security  Agency’s  record  of  compliance,  and  the  importance  of  these  programs  to  the  national 
security  of  the  United  States. 

XTS)>  We  believe  that  making  this  document  available  to  all  Members  of  Congress,  as  we  did 
with  a similar  document  in  December  2009,  is  an  effective  way  to  inform  the  legislative  debate 
about  reauthorization  of  Section  215.  However,  as  you  know,  it  is  critical  that  Members 
understand  the  importance  to  national  security  of  maintaining  the  secrecy  of  these  programs,  and 
that  the  HPSCI's  plan  to  make  the  document  available  to  other  Members  is  subject  to  the  strict 
rules  set  forth  below. 

■(TS)  Like  the  document  provided  to  the  Committee  on  December  13,  2009,  the  enclosed 
document  is  being  provided  on  the  understanding  that  it  will  be  provided  only  to  Members  of 
Congress  (and  cleared  HPSCI,  Judiciary  Committee,  and  leadership  staff),  in  a secure  location  in 
the  HPSCI's  offices,  for  a limited  time  period  to  be  agreed  upon,  and  consistent  with  the  rules  of 
the  HPSCI  regarding  review  of  classified  information  and  non-disclosure  agreements.  No 
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photocopies  may  be  made  of  the  document,  and  any  notes  taken  by  Members  may  not  be 
removed  from  the  secure  location.  We  further  understand  that  HPSCI  staff  will  be  present  at  all 
times  when  the  document  is  being  reviewed,  and  that  Executive  Branch  officials  will  be 
available  nearby  during  certain,  pre-established  times  to  answer  questions  should  they  arise.  We 
also  request  your  support  in  ensuring  that  the  Members  are  well  informed  regarding  the 
importance  of  this  classified  and  extremely  sensitive  information  to  prevent  any  imauthorizcd 
disclosures  resulting  from  this  process.  We  intend  to  provide  the  same  document  to  the  Senate 
Select  Committee  on  Intelligence  (SSCI)  under  similar  conditions,  so  that  it  may  be  made 
available  to  the  Members  of  the  Senate,  as  well  as  cleared  leadership,  SSCI  and  Senate  Judiciary 
Committee  staff. 

(U)  We  look  forward  to  continuing  to  work  with  you  and  your  staff  as  Congress  continues  its 
deliberations  on  reauthorizing  the  expiring  provisions  of  the  USA  PATRIOT  Act. 


Sincerely, 


Ronald  Welch 
Assistant  Attorney  General 
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~(TS//8I//Nr)  Report  on  the  National  Security  Agency’s  Bulk  Collection  Programs 
for  USA  PATRIOT  Act  Reauthorization 

(U)  THE  INFORMATION  CONTAINED  IN  THIS  REPORT  DESCRIBES  SOME  OF 
THE  MOST  SENSITIVE  FOREIGN  INTELLIGENCE  COLLECTION  PROGRAMS 
CONDUCTED  BY  THE  UNITED  STATES  GOVERNMENT.  THIS  INFORMATION  IS 
HIGHLY  CLASSIFIED  AND  ONLY  A LIMITED  NUMBER  OF  EXECUTIVE  BRANCH 
OFFICIALS  HAVE  ACCESS  TO  IT.  PUBLICLY  DISCLOSING  ANY  OF  THIS 
INFORMATION  WOULD  BE  EXPECTED  TO  CAUSE  EXCEPTIONALLY  GRAVE 
DAMAGE  TO  OUR  NATION’S  INTELLIGENCE  CAPABILITIES  AND  TO  NATIONAL 
SECURITY.  THEREFORE  IT  IS  IMPERATIVE  THAT  ALL  WHO  HAVE  ACCESS  TO  THIS 
DOCUMENT  ABIDE  BY  THEIR  OBLIGATION  NOT  TO  DISCLOSE  THIS  INFORMATION 
TO  ANY  PERSON  UNAUTHORIZED  TO  RECEIVE  IT. 


Key  Points 


• (U)  Section  2 1 5 of  the  USA  PATRIOT  Act,  which  expires  at  the  end  of  February  2011, 
allows  the  government,  upon  approval  of  the  Foreign  Intelligence  Surveillance  Court 
(“FISA  Court”),  to  obtain  access  to  certain  business  records  for  national  security 
investigations; 

• (U)  Section  402  of  the  Foreign  Intelligence  Surveillance  Act  (“FISA”),  which  is  not 
subject  to  a sunset,  allows  the  government,  upon  approval  of  the  FISA  Court,  to  install 
and  use  a pen  register  or  trap  and  trace  (“pen/trap”)  device  for  national  security 
investigations; 

• ■ (TS/ZSIAT-JF-)  These  authorities  support  two  sensitive  and  important  intelligence  collection 
programs.  These  programs  are  authorized  to  collect  in  bulk  certain  dialing,  routing, 
addressing  and  signaling  information  about  telephone  calls  and  electronic 
communications,  such  as  the  telephone  numbers  or  e-mail  addresses  that  were 
communicating  and  the  times  and  dates  but  not  the  content  of  the  calls  or  e-mail 
messages  themselves; 

• (TS//S1//NF)  Although  the  programs  collect  a large  amount  of  information,  the  vast 
majority  of  that  information  is  never  reviewed  by  any  person,  because  the  information  is 
not  responsive  to  the  limited  queries  that  are  authorized  for  intelligence  purposes; 

• (TS//SI//NF)  The  programs  are  subject  to  an  extensive  regime  of  internal  eheeks, 
particularly  for  U.S.  persons,  and  are  monitored  by  the  FISA  Court  and  Congress; 

• (TS//SI//NF)  Although  there  have  been  compliance  problems  in  recent  years,  the 
Executive  Branch  has  worked  to  resolve  them,  subject  to  oversight  by  the  FISA  Court; 
and 

• (TS//SL0T‘4F)~  The  National  Security  Agency’s  (NSA)  bulk  collection  programs  provide 
important  tools  in  the  fight  against  terrorism,  especially  in  identifying  terrorist  plots 
against  the  homeland.  These  tools  are  also  unique  in  that  they  can  produce  intelligence 
not  otherwise  available  to  NSA. 


Tef-seeftE?weeMiNT//N©F©j«^ 


Background 

(TS//Sl//NF)-Since  the  tragedy  of  9/1 1,  the  Intelligence  Community  has  developed  an 
array  of  capabilities  to  detect,  identify  and  disrupt  terrorist  plots  against  the  United  States  and  its 
interests.  Detecting  threats  by  exploiting  terrorist  communications  has  been,  and  continues  to  be, 
one  of  the  critical  tools  in  that  effort.  Above  all  else,  it  is  imperative  that  we  have  a capability  to 
rapidly  identify  any  terrorist  threats  emanating  from  within  the  United  States. 

XrS//SL/'l'JF)  Prior  to  the  attacks  of  9/1 1 , the  NSA  intercepted  and  transcribed  seven  calls 
from  hijacker  Khalid  al-Mihdhar  to  a facility  associated  with  an  al  Qa’ida  safehouse  in  Yemen. 
However,  NSA’s  access  point  overseas  did  not  provide  the  technical  data  indicating  the  location 
from  where  al-Mihdhar  was  calling.  Lacking  the  originating  phone  number,  NSA  analysts 
concluded  that  al-Mihdhar  was  overseas.  In  fact,  al-Mihdhar  was  calling  from  San  Diego, 
California.  According  to  the  9/1 1 Commission  Report  (pages  269-272): 

"Investigations  or  interrogation  of  them  [Khalid  al-Mihdhar,  etc],  and  investigation  of 

their  travel  and  financial  activities  could  have  yielded  evidence  of  connections  to  other 

participants  in  the  9/11  plot.  The  simple  fact  of  their  detention  could  have  derailed  the 

plan.  In  any  case,  the  opportunity  did  not  arise.  ” 

tTS//Si//NF)-Today,  under  FISA  Court  authorization  pursuant  to  the  “business  records” 
authority  of  the  FISA  (commonly  referred  to  as  “Section  215”),  the  government  has  developed  a 
program  to  close  the  gap  that  allowed  al-Mihdhar  to  plot  undetected  within  the  United  States 
while  communicating  with  a known  terrorist  overseas.  This  and  similar  programs  operated 
pursuant  to  FISA,  including  exercise  of  pen/trap  authorities,  provide  valuable  intelligence 
information. 

(U)  Absent  legislation.  Section  215  will  expire  on  February  28,  2011,  along  with  the  so- 
callcd  “lone  wolf’  provision  and  roving  wiretaps  (which  this  document  does  not  address).  The 
pen/trap  authority  does  not  expire. 

(TS//SI//NF)'  The  Section  215  and  pen/trap  authorities  are  used  by  the  U.S.  Government 
in  selected  cases  to  acquire  significant  foreign  intelligence  information  that  cannot  otherwise  be 
acquired  either  at  all  or  on  a timely  basis.  Any  U.S.  person  information  that  is  acquired  is 
subject  to  strict,  court-imposed  restrictions  on  the  retention,  use,  and  dissemination  of  such 
information  and  is  also  subject  to  strict  and  frequent  audit  and  reporting  requirements. 

~(TS//01/iT'Jr)  The  largest  and  most  significant  use  of  these  authorities  is  to  support  two 
important  and  highly  sensitive  intelligence  collection  programs  under  which  NSA  collects  and 
analyzes  large  amounts  of  transactional  data  obtained  from  certain  telecommunications  service 
the  States. 

Although  these  programs  have  been  briefed  to  the 
Intelligence  and  Judiciary  Committees,  it  is  important  that  other  Members  of  Congress  have 
access  to  information  about  these  two  programs  when  considering  reauthorization  of  the  expiring 
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PATRIOT  Act  provisions.  The  Executive  Branch  views  it  as  essential  that  an  appropriate 
statutory  basis  remains  in  place  for  NSA  to  conduct  these  two  programs. 


Section  215  and  Pen-Trap  Collection 


~(TS//310T''IF)-Under  the  program  based  on  Section  215,  NSA  is  authorized  to  collect  from 
certain  telecommunications  service  providers  certain  business  records  that  contain  information 
about  communications  between  two  telephone  numbers,  such  as  the  date,  time,  and  duration  of  a 
call.  There  is  no  collection  of  the  content  of  any  telephone  call  under  this  program,  and  under 
longstanding  Supreme  Court  precedent  the  information  collected  is  not  protected  by  the  Fourth 
Amendment.  In  this  program,  court  orders  (generally  lasting  90  days)  arc  served  on^^mn 
companies 


The  orders  generally  require  production  of  the  business  records  (as  described 
above)  relating  to  substantially  all  of  the  telephone  calls  handled  by  the  companies,  including 
both  calls  made  between  the  United  States  and  a foreign  country  and  calls  made  entirely  within 
the  United  States. 


~(TS/ySt//N F).  Under  the  program  based  on  the  pen/trap  provision  in  FISA,  the  government 
is  authorized  to  collect  similar  kinds  of  information  about  electronic  commimications  - such  as 
“to”  and  “from”  lines  in  e-mail,  certain  routing  information,  and  the  date  and  time  an  e-mail  is 
sent  - excluding  the  content  of  the  e-mail  and  the  “subject”  line.  Again,  this  information  is 
collected  pursuant  to  court  orders  (generally  lasting  90  days)  and,  under  relevant  court  decisions, 
is  not  protected  by  the  Fourth  Amendment. 


However,  as  described  below,  only  a tiny  fraction  of  such  records  are  ever  viewed  by  NSA 
intelligence  analysts. 


Checks  and  Balances 


FISA  Court  Oversight 

(TS//SI//NF)  To  conduct  these  bulk  collection  programs,  the  government  has  obtained 
orders  from  several  different  FISA  Court  judges  based  on  legal  standards  set  forth  in  Section  215 
and  the  FISA  pen/trap  provision.  Before  obtaining  any  information  from  a telecommunications 
service  provider,  the  government  must  establish,  and  the  FISA  Court  must  conclude,  that  the 
information  is  relevant  to  an  authorized  investigation.  In  addition,  the  government  must  comply 
with  detailed  “minimization  procedures”  required  by  the  FISA  Court  that  govern  the  retention 
and  dissemination  of  the  information  obtained.  Before  NSA  analysts  may  query  bulk  records, 
they  must  have  reasonable  articulable  suspicion  - referred  to  as  “RAS”  - that  the  number  or  e- 
mail  address  they  submit  is  associated 
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RAS  requirement  is  designed  to  protect  against  the  indiscriminate  querying  of  the  collected  data 
so  that  only  information  pertaining  to  one  of  the  foreign  powers  listed  in  the  relevant  Court  order 


is  provided  to  NSA  personnel  for  further  intelligence  analysis.  The  bulk  data 
collected  under  each  program  can  be  retained  for  5 years. 


Congressional  Oversight 

(U)  These  programs  have  been  briefed  to  the  Intelligence  and  Judiciary  Committees, 
through  hearings,  briefings,  and  visits  to  NSA.  In  addition,  the  Intelligence  and  Judiciary 
Committees  have  been  fully  briefed  on  the  compliance  issues  discussed  below. 


Compliance  Issues 


(TS//SI//NF)  In  2009,  a number  of  technical  compliance  problems  and  human 
implementation  errors  in  these  two  bulk  collection  programs  were  discovered  as  a result  of 
Department  of  Justice  (DOJ)  reviews  and  internal  NSA  oversight.  However,  neither  DOJ,  NSA, 
nor  the  FISA  Court  has  found  any  intentional  or  bad-faith  violations. 


accordance  with  the  Court’s  rules,  upon  discovery,  these  inconsistencies  were  reported  as 
compliance  incidents  to  the  FISA  Court,  which  ordered  appropriate  remedial  action.  The  FISA 
Court  placed  several  restrictions  on  aspects  of  the  business  records  collection  program  until  the 
compliance  processes  were  improved  to  its  satisfaction. 


(U)  The  incidents,  and  the  Court’s  responses,  were  also  reported  to  the  Intelligence  and 
Judiciary  Committees  in  great  detail.  The  Committees,  the  Court  and  the  Executive  Branch  have 
responded  actively  to  the  incidents.  The  Court  has  imposed  safeguards  that,  together  with 
greater  efforts  by  the  Executive  Branch,  have  resulted  in  significant  and  effective  changes  in  the 
compliance  program. 

(U)  All  parties  will  continue  to  report  to  the  FISA  Court  and  to  Congress  on  compliance 
issues  as  they  arise,  and  to  address  them  effectively. 
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Intelli2ence  Value  of  the  Collection 


-(TOZ/SPiO^jr)  As  noted,  these  two  collection  programs  significantly  strengthen  the 
Intelligence  Community’s  early  warning  system  for  the  detection  of  terrorists  and  discovery  of 
plots  against  the  homeland.  They  allow  the  Intelligence  Community  to  detect  phone  numbers 
and  e-mail  addresses  within  the  United  States  that  may  be  contacting  targeted  phone  numbers 
and  e-mail  addresses  associated  with  suspected  foreign  terrorists  abroad  and  vice-versa;  and 
entirely  domestic  connections  between  entities  within  the  United  States  tied  to  a suspected 
foreign  terrorist  abroad.  NSA  needs  access  to  telephony  and  e-mail  transactional  information  in 
bulk  so  that  it  can  quickly  identify  and  assess  the  network  of  contacts  that  a targeted  number  or 
address  is  connected  to,  whenever  there  is  RAS  that  the  targeted  number  or  address  is  associated 
with 

Importantly,  there  are  no  intelligence  collection  tools  that,  independently  or  in 
combination,  provide  an  equivalent  capability. 


(TS//SI//NF)  To  maximize  the  operational  utility  of  the  data,  the  data  cannot  be  collected 
prospectively  once  a lead  is  developed  because  important  connections  could  be  lost  in  data  that 
was  sent  prior  to  the  identification  of  the  RAS  phone  number  or  e-mail  address.  NSA  identifies 
the  network  of  contacts  by  applying  sophisticated  analysis  to  the  massive  volume  of  metadata  - 
but  always  based  on  links  to  a number  or  e-mail  address  which  itself  is  associated  with  a 
counterterrorism  target.  (Again,  communications  metadata  is  the  dialing,  routing,  addressing  or 
signaling  information  associated  with  an  electronic  communication,  but  not  content ) The  more 
metadata  NSA  has  access  to,  the  more  likely  it  is  that  NSA  can  identify,  discover  and  understand 
the  network  of  contacts  linked  to  targeted  numbers  or  addresses  Information  discovered  through 
NSA’s  analysis  of  the  metadata  is  then  provided  to  the  appropriate  federal  national  security 
agencies,  including  the  FBI,  which  are  responsible  for  further  investigation  or  analysis  of  any 
potential  terrorist  threat  to  the  United  States. 


(TS//SF/NF)  In  conclusion,  the  Section  215  and  pen/trap  bulk  collection  programs 
provide  an  important  capability  to  the  Intelligence  Community.  The  attacks  of  9/1 1 taught  us 
that  applying  lead  information  from  foreign  intelligence  in  a comprehensive  and  systemic 
fashion  is  required  to  protect  the  homeland,  and  the  programs  discussed  in  this  paper  cover  a 
critical  seam  in  our  defense  against  terrorism.  Recognizing  that  the  programs  have  implications 
for  the  privacy  interests  of  U.S.  person  data,  extensive  policies,  safeguards,  and  reviews  have 
been  enacted  by  the  FISA  Court,  DOJ,  ODNI  and  NSA. 
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